The architecture of multiple elevator control systems normally consists of a car controller for each car to perform car-related signaling and motion functions and a separate group controller to perform group-related signaling and dispatching functions. Group control functions are those functions relating to the response of several cars to hall calls. The weak point of such a system architecture is the group controller. If the group controller fails, there is no further response to group signals, such as hall calls. To guarantee further group control in case of a group failure, at least a second group controller has to be provided, with additional circuitry to detect a group failure and switch to the second redundant group controller.